GORBLE
GORBLE is a multi-stage PowerShell-based malware variant associated with the Iran-based threat group GreenCharlie. The reported framework includes GORBLE, TAMECAT, and POWERSTAR, and is described as using layered obfuscation, layered decryption, and in-memory execution to evade detection. In the documented execution chain, an initial stage decodes a hardcoded URL and downloads a second-stage script; a subsequent stage exposes a function referred to as KeyMaster or Borjol through Base64 decoding and a bitwise NOT operation, then uses AES with a hard-coded key and IV to decrypt an embedded data blob. Unlike TAMECAT and POWERSTAR, which reportedly execute decrypted payloads with Invoke-Expression, GORBLE is specifically described as executing decrypted payloads via ScriptBlock.Create. A later stage performs initial command-and-control by collecting victim OS and computer name, formatting that host data as JSON, encrypting it with AES, Base64-encoding it, and sending it via HTTP POST to the C2 server. GreenCharlie has used this malware ecosystem in cyber-espionage and phishing operations active since at least 2020 and continuing through late 2024, supported by rapidly rotated infrastructure and lure-themed domains registered through commercial registrars and DDNS providers. Reported lure and infrastructure examples tied to the broader GreenCharlie activity include activeeditor[.]info, webviewerpage[.]info, documentcloudeditor.ddnsgeek[.]com, coldwarehexahash.dns-dynamic[.]net, uptime-timezone.dns-dynamic[.]net, and translatorupdater.dns-dynamic[.]net; documentcloudeditor.ddnsgeek[.]com was observed resolving to 38.180.146[.]174 and hosting a PhishTest portal. The activity is mapped in the source content to MITRE ATT&CK techniques including T1566.002 (spearphishing link), T1059.001 (PowerShell), T1568 (dynamic resolution), T1583.001 (acquire infrastructure: domains), and T1665 (hide infrastructure).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“GreenCharlie’s toolset centers on a multi-stage PowerShell-based malware framework, including variants known as GORBLE, TAMECAT, and POWERSTAR.”
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique"The group utilizes the commercial registrar Namecheap to register domains that are thematically aligned with their social engineering lures..."
Execution
1 technique"The entire GORBLE, TAMECAT, and POWERSTAR malware family is constructed as a multi-stage PowerShell execution chain."
Command and Control
1 technique"GreenCharlie leveraged dynamic DNS (DDNS) to establish and manage its infrastructure..."
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat Details and IOCs Malware: BASICSTAR, CharmPower, GORBLE, GorjolEcho, NICECURL, POWERSTAR, TAMECAT
A multi-stage, PowerShell-based malware variant used by GreenCharlie. It uses layered obfuscation (Base64 + bitwise NOT), decrypts an embedded payload with AES (hard-coded key/IV) and executes it in-memory (notably via ScriptBlock.Create), then beacons to C2 over HTTP POST after collecting basic host info (OS, computer name) and encrypting/encoding it (AES + Base64).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.